Legal

Privacy

Last updated 30 October 2026

In short: we keep what is needed to run your account and nothing more. No advertising, no selling of data, no profiling, and no third-party tracking unless you allow it.

Who is responsible

The data controller for 3DGarden is the operator named below. Write to us about anything on this page.

Operator: 3DGarden
Contact: contact@3dgarden.app, or the contact page
Host: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France

What we collect

Your account: your email address, a password stored only as a one-way hash, the display name you choose (optional), the date you joined and whether you have confirmed your email.
Signing in with Google: if you choose it, Google sends us your email address, your name and a Google account identifier. We receive nothing else, and no password is stored.
Downloads: which model you downloaded, when, and the IP address the request came from.
Favourites and your collections: the models you save, and the collections you make from them.
API keys: the name you give each key, its first characters and a hash of it (never the key itself), and when it was last used.
Coffees: the amount, the currency, the date, whether it is one-off or monthly, and the references Stripe gives us for the payment, the customer and any monthly subscription. Your card details go to Stripe and never reach us.
Messages: when you use the contact page, the name, email address and organisation you give, your message, your account if you are signed in, and your IP address.
Security: counts of recent failed sign-in attempts per IP address and per email address, and single-use links for confirming an email or resetting a password, with the IP address that asked for them.
Usage counts: how many times each page, model, search term and tag is used per day. These counts are anonymous: no account, no session, no IP address, nothing stored on your device.

The cookies we set, and why, are listed on the Cookies page.

Why, and on what basis

To provide the service you asked for (performance of a contract): your account, sign-in, downloads, favourites, collections, API keys, coffees and the emails about them (confirming your address, resetting a password, a receipt).
To keep the site secure and fair (our legitimate interest): limiting sign-in attempts, spotting abuse of downloads, the API and the contact form, and investigating it. This is why IP addresses are recorded.
To understand which models are useful (our legitimate interest): the anonymous usage counts.
To answer you (our legitimate interest, or a step you asked for): contact messages.
To meet legal duties (legal obligation): keeping payment records for accounting.
Optional cookies (your consent): only if you allow them on the Cookies page, and you can withdraw it there at any time.

We do not send newsletters or marketing emails, we do not sell or rent your data, and we do not use it for advertising or automated decisions about you.

Who else sees it

Only the providers we need to run the site, each for its own part:

OVH SAS (France) hosts the site, the database and the files, and sends our emails. Your data is stored in the European Union.
Stripe (Stripe Payments Europe Ltd, Ireland) processes coffee payments, under Stripe's privacy policy.
Google (Google Ireland Ltd), only if you sign in with Google, under Google's privacy policy.

Stripe and Google may transfer data outside the European Union; when they do, they rely on the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or adequacy decisions. Otherwise, we disclose data only when the law requires it.

How long we keep it

Your account, downloads, favourites, collections and API keys: as long as the account exists. They are deleted with it.
Payment records: as long as accounting law requires, which in France is up to ten years, even after the account is deleted.
Contact messages: as long as needed to deal with them and any follow-up, then deleted.
Failed sign-in counts: 15 minutes.
Email links: a confirmation link lasts 3 days, a password reset link 60 minutes; both are deleted after they expire.
"Remember me" sign-ins: 60 days, or until you sign out.
Anonymous usage counts: 400 days, then deleted.

Your rights

Under the GDPR you can ask us to access the data we hold about you, correct it, delete it, receive a copy in a portable format, restrict its use, or object to a use based on our legitimate interest. You can withdraw a consent at any time.

You can change your display name from your account, and your password with Forgot password. For anything else, including deleting your account, write to us from the contact page or at contact@3dgarden.app, from the address on your account. We answer within one month.

If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL, or to the authority of the country where you live.

Security

The site is served only over HTTPS. Passwords and API keys are stored only as hashes, sign-in attempts are limited, forms are protected against forgery, and access to the data is restricted to the people who run the site.

Children

Accounts are for people aged 15 or over, or younger with a parent's or guardian's permission. If you believe a child has given us data without it, tell us and we will delete it.

Changes

If this page changes, the date at the top changes with it. If a change affects how your data is used, we will tell you by email or on the site before it applies.